diff --git a/agent99-signoz-metadata-executor.ps1 b/agent99-signoz-metadata-executor.ps1
index 230f8eb12..37878233f 100644
--- a/agent99-signoz-metadata-executor.ps1
+++ b/agent99-signoz-metadata-executor.ps1
@@ -501,16 +501,16 @@ function Invoke-Agent99SignozToolchainScp {
   $stderrPath = Join-Path $env:TEMP "agent99-signoz-toolchain-scp-$token.err"
   $script:TransientTransportOutputUsed = $true
   try {
-    $process = Start-Process -FilePath "scp.exe" -ArgumentList $arguments `
+    $scpProcess = Start-Process -FilePath "scp.exe" -ArgumentList $arguments `
       -NoNewWindow -RedirectStandardOutput $stdoutPath `
       -RedirectStandardError $stderrPath -PassThru
-    if (-not $process.WaitForExit(180000)) {
-      try { & taskkill.exe /PID $process.Id /T /F 2>&1 | Out-Null } catch {}
+    if (-not $scpProcess.WaitForExit(180000)) {
+      try { & taskkill.exe /PID $scpProcess.Id /T /F 2>&1 | Out-Null } catch {}
       return $false
     }
-    $process.WaitForExit() | Out-Null
-    $process.Refresh()
-    return [bool]($process.HasExited -and [int]$process.ExitCode -eq 0)
+    $scpProcess.WaitForExit() | Out-Null
+    $scpProcess.Refresh()
+    return [bool]($scpProcess.HasExited -and [int]$scpProcess.ExitCode -eq 0)
   } finally {
     Remove-Item -LiteralPath $stdoutPath, $stderrPath -Force -ErrorAction SilentlyContinue
     if ((Test-Path -LiteralPath $stdoutPath) -or (Test-Path -LiteralPath $stderrPath)) {
diff --git a/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py b/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py
index 79f7dd1d3..6f34305de 100644
--- a/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py
+++ b/scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py
@@ -168,6 +168,23 @@ def test_entrypoint_uses_typed_stdout_without_windows_process_exit_code() -> Non
     assert "taskkill.exe /PID $process.Id /T /F" in transport
 
 
+def test_toolchain_scp_uses_scoped_bounded_process_exit_readback() -> None:
+    source = ENTRYPOINT.read_text(encoding="utf-8")
+    transport = source[
+        source.index("function Invoke-Agent99SignozToolchainScp") : source.index(
+            "function New-Agent99SignozLockedRemoteCommand"
+        )
+    ]
+
+    assert '$scpProcess = Start-Process -FilePath "scp.exe"' in transport
+    assert "$scpProcess.WaitForExit(180000)" in transport
+    assert "taskkill.exe /PID $scpProcess.Id /T /F" in transport
+    assert "$scpProcess.WaitForExit()" in transport
+    assert "$scpProcess.Refresh()" in transport
+    assert "$scpProcess.HasExited -and [int]$scpProcess.ExitCode -eq 0" in transport
+    assert "$process.ExitCode" not in source
+
+
 def test_entrypoint_preflight_has_explicit_credential_and_artifact_state_contracts() -> (
     None
 ):